#include <windows.h>
#include <stdio.h>

//typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
//	WORD   e_magic;                     // Magic number
//	WORD   e_cblp;                      // Bytes on last page of file
//	WORD   e_cp;                        // Pages in file
//	WORD   e_crlc;                      // Relocations
//	WORD   e_cparhdr;                   // Size of header in paragraphs
//	WORD   e_minalloc;                  // Minimum extra paragraphs needed
//	WORD   e_maxalloc;                  // Maximum extra paragraphs needed
//	WORD   e_ss;                        // Initial (relative) SS value
//	WORD   e_sp;                        // Initial SP value
//	WORD   e_csum;                      // Checksum
//	WORD   e_ip;                        // Initial IP value
//	WORD   e_cs;                        // Initial (relative) CS value
//	WORD   e_lfarlc;                    // File address of relocation table
//	WORD   e_ovno;                      // Overlay number
//	WORD   e_res[4];                    // Reserved words
//	WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
//	WORD   e_oeminfo;                   // OEM information; e_oemid specific
//	WORD   e_res2[10];                  // Reserved words
//	LONG   e_lfanew;                    // File address of new exe header
//} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
#ifdef UNICODE
#undef UNICODE
#endif

void DumpExeFile(PIMAGE_DOS_HEADER dosHeader)
{
}

void DumpObjFile(PIMAGE_FILE_HEADER lpFileBase)
{

}

void DumpFile(LPSTR filename)
{
    HANDLE hFile;
    HANDLE hFileMapping;
    LPVOID lpFileBase;
    PIMAGE_DOS_HEADER dosHeader;
    
    hFile = CreateFileA(filename, GENERIC_READ, FILE_SHARE_READ, NULL,
                        OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
                    
    if ( hFile == INVALID_HANDLE_VALUE )
    {   printf("Couldn't open file with CreateFile()\n");
        return; }
    
    hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    if ( hFileMapping == 0 )
    {   CloseHandle(hFile);
        printf("Couldn't open file mapping with CreateFileMapping()\n");
        return; }
    
    lpFileBase = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
    if ( lpFileBase == 0 )
    {
        CloseHandle(hFileMapping);
        CloseHandle(hFile);
        printf("Couldn't map view of file with MapViewOfFile()\n");
        return;
    }

    printf("Dump of file %s\n\n", filename);
    
    dosHeader = (PIMAGE_DOS_HEADER)lpFileBase;
    if ( dosHeader->e_magic == IMAGE_DOS_SIGNATURE )
       { DumpExeFile( dosHeader ); }
    else if ( (dosHeader->e_magic == 0x014C)    // Does it look like a i386
              && (dosHeader->e_sp == 0) )        // COFF OBJ file???
    {
        // The two tests above aren't what they look like.  They're
        // really checking for IMAGE_FILE_HEADER.Machine = = i386 (0x14C)
        // and IMAGE_FILE_HEADER.SizeOfOptionalHeader = = 0;
        DumpObjFile( (PIMAGE_FILE_HEADER)lpFileBase );
    }
    else
        printf("unrecognized file format\n");
    UnmapViewOfFile(lpFileBase);
    CloseHandle(hFileMapping);
    CloseHandle(hFile);
}

int main() 
{ 
	char *fileName = "D:\\workspace\\test\\ntkrnlpa.exe";
	FILE *fp = fopen(fileName,"rb");

	if(fp==NULL)
	{
		printf("Can not open %s \n",fileName);
		return 1;
	}

	IMAGE_DOS_HEADER dosHeader;

	fread(&dosHeader,sizeof(IMAGE_DOS_HEADER),1,fp);

	printf("%c\n",dosHeader.e_magic&0xFF);
	printf("%c\n",(dosHeader.e_magic>>8)&0xFF);

	printf("%d\n",sizeof(IMAGE_DOS_HEADER));
	return 0; 
} 
